General
- Target 94e6a516dbaead39c4ee000bfd6af7ef8f4013ab831516e9b55007fbc9b7ae0b
- Size 190KB
- Sample260730-hzd9jade73
- SHA256 94e6a516dbaead39c4ee000bfd6af7ef8f4013ab831516e9b55007fbc9b7ae0b
Score
8/10
Malware Config
Targets
-
- Target NEW PURCHASE ORDER.vbs
- Size 451KB
- SHA256 cfc28d22f21bec2b2eaf4f9812a6ded77cc8bb623bec528fefe7ccdeed645283
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Registers new Windows logon scripts automatically executed at logon.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
Executes a VBScript file via the Windows Script Host.
-
Suspicious use of SetThreadContext